1. Field of the Invention
The present invention relates to safety systems for nuclear reactors. More specifically, this invention is directed to the prediction of internal reactor conditions commensurate with maintaining the integrity of the fuel element cladding. Accordingly, the general object of the present invention is to provide novel and improved apparatus and methods of such character.
The performance of a nuclear reactor, like that of many other energy conversion devices, is limited by the temperatures which component materials will tolerate without failure. In the case of a reactor with a core comprising an assemblage of fuel assemblies which in turn consist of an array of fuel rods or pins, the upper limit of temperature is imposed by the fuel rod or fuel pin cladding material employed. In order to adequately protect the reactor core against excessive temperatures, it is necessary to examine the temperature of the "hottest" fuel pin or the "hottest" coolant channel between adjacent fuel pins of the core, since damage will first occur in the "hottest" fuel pin. Thus the "hottest" pin or channel becomes the limiting pin or channel for the reactor core.
As is well known, heat is generated in a reactor by the fission process in the fuel material. The fission process, however, produces not only heat but radioactive isotopes which are potentially harmful and which must be prevented from escaping to the environment. To this end, the fuel is clad with a material which retains the fission products. In order to prevent clad overheating and in the interest of precluding release of the fission products which would occur on clad damage or failure, a coolant is circulated through the reactor core. Heat transferred to the circulating coolant from the fuel elements is extracted therefrom in the form of usable energy downstream of the reactor core in a steam generator. Thus, for example, in a pressurized water reactor system, the water flowing through the core is kept under pressure and is pumped to the tube side of a steam generator where its heat is transferred to water on the shell side of the generator. The water on the shell side is under lower pressure and thus the thermal energy transfer causes the secondary water to boil and the steam so generated is employed to drive the turbine.
To summarize, in the design and operation of a nuclear reactor, the basic objective of removing heat from the fuel must be obtained without allowing the temperature of the fuel cladding of the limiting fuel pin to rise to such a degree that the clad will fail.
As the coolant circulates through the reactor core, heat will be transferred thereto either through subcooled convection, often referred to as film conduction, or through nucleate boiling. Nucleate boiling occurs at higher levels of heat flux and is the preferred mode of operation since it permits more energy to be transferred to the coolant thereby permitting the reactor to be operated at higher levels of efficiency. Nucleate boiling is characterized by the formation of steam bubbles at nucleation sites in the heat transfer surface. These bubbles break away from the surface and are carried into the main coolant stream. If the bulk coolant enthalpy is below saturation, the steam bubbles collapse with no net vapor formation in the channel. This phenomenon is called subcooled boiling or local boiling. If the bulk fluid enthalpy is at or above enthalpy of saturated liquid, the steam bubbles do not collapse and the coolant is said to be in bulk boiling.
If the heat flux is increased to a sufficiently high value, the bubbles formed on the heat transfer surface during nucleate boiling are formed at such a high rate that they cannot be varied away as rapidly as they are formed. The bubbles then tend to coalesce on the heat transfer surface and form a vapor blanket or film. This film imposes a high resistance to heat transfer and the temperature drop across the film can become very large even though there is no further increase in heat flux. The transition from nucleate boiling to film boiling is called "departure from nucleate boiling", hereinafter referred to as DNB, and the value of the heat flux at which it occurs is called the "DNB heat flux" in a pressurized water reactor or the "critical heat flux" in a boiling water reactor. A factor also to be considered is the creation of flow instabilities resulting from excessive coolant void fractions.
Another condition which requires protective action is the occurrence of a high local power density in one of the fuel pins. An excessive local power density inititates centerline fuel melting which may lead to a violation of the fuel clad integrity. In addition, a condition of excessive local power density is unacceptable in the event of a Loss of Coolant Accident (LOCA) since excessive local power densities would cause the clad temperature to exceed allowable limits if the coolant were lost. As the result of analyses of Loss of Coolant Accidents, values are established by the reactor designers for the maximum allowable local power densities at the inception of a LOCA such that the criteria for acceptable consequences are met. The maximum local power density or local power limit is generally specified as a kilowatt per foot (KW/ft) limit.
A third condition which acts as an operating limit is the licensed power at which the particular reactor is permitted to run. All three of these "limiting conditions for operation" must be monitored in order to make reactor operation safe. Since clad damage is likely to occur because of a decrease in heat transfer coefficient and the accompanying higher clad temperatures which may result when DNB occurs, or because of an excessive local power density, the onset of these conditions must be sensed or predicted and corrective action in the form of a reduction in fission rate promptly instituted. Restated, in reactor operation DNB must be prevented since the concurrent reduction in clad strength as temperature increases can lead to a clad failure because of the external coolant pressure or because of the internal fission gas pressures in the fuel rod. One way of monitoring DNB in the reactor is to generate an index or a correlation which indicates the reactor condition with respect to the probability of the occurrence of DNB. (See L. S. Tong, "Prediction of DNB for an Axially Non-uniform Heat Flux Distribution", Journal of Nuclear Energy, 21:241, 1967). This correlation is alternatively called Departure from Nucleate Boiling Ratio (DNBR) or Critical Heat Flux Ratio and is defined as the ratio of the heat flux necessary to achieve DNB at specific local coolant conditions to the actual local heat flux. The two correlations stem from slightly differing statistical derivations so that the critical values of DNBR and critical heat flux ratio are defined to be 1.3 and 1 respectively. These are the statistically established limiting values above which DNB has a very small probability of occurring. In the following discussion and claims, it should be understood that DNBR will be used, for the sake of simplicity, as describing both of the correlations. Thus, DNBR for the purposes of this discussion and description, shall mean both the Tong W-3 correlation for Departure from Nucleate Boiling Ratio and the Critical Heat Flux Ratio Correlation. Additionally, an excessive KW/ft. in the limiting or "hottest" fuel pin in the core must be avoided in order to maintain the integrity of the cladding or to prevent violation of the limiting conditions for operation established by a Loss of Coolant Accident analysis.
It is known that DNB occurs as a function of the reactor operating parameters of heat flux or power distribution, primary coolant mass flow rate, primary coolant pressure and primary coolant temperature. In order to prevent an excessive KW/ft. or DNB (also called "burn-out") or "boiling crisis", reactor protective systems must be designed to insure that reactor operation is rapidly curtailed, a condition known in the art as "reactor trip" or "reactor scram", before the combination of conditions commensurate with DNB or excessive local power density can exist. Departure from nucleate boiling and DNB Ratio may be expressed for one fuel pin or channel as: EQU DNBR = f(.phi., Tc, P, m, F.sub.r, F.sub.z (z), T.sub.r) (1)
and the LOCA or centerline fuel melt limit may be expressed as: EQU KW/FT limit = f(.phi., F.sub.r, F.sub.z (z)) (2)
where:
.phi. = Core Power in Percent of Fuel Power
T.sub.c = Coolant Inlet Temperature
p = Coolant Pressure m = Coolant Mass Flow Rate
F.sub.r = Integral Radial power Peaking Factor
F.sub.z (z) = Axial Power Distribution in the Pin which has the Integral Radial Power Peaking Factor
T.sub.r = Azimuthal tilt magnitude which is a measure of side to side xenon oscillation.
Core power in percent of full power may be determined in a manner similar to that disclosed in the referenced U.S. Pat. No. 3,752,735 entitled "Instrumentation for Nuclear Reactor". Integral radial power peaking factor is defined as the maximum ratio of power generated in any fuel pin in the core to the average fuel pin power.
Axial power distribution is defined for each fuel pin as a curve of local pin power density versus axial distance up the pin divided by the total power generated in the pin. See the "Description of the Preferred Embodiment" and the "Appendix to the Description of the Preferred Embodiment" for a more detailed discussion.
The other parameters of coolant inlet temperature, reactor coolant system pressure and coolant mass flow rate may be determined in conventional manners. For example, see co-pending U.S. Pat. No. 3,781,922 entitled "Thermal Margin Protection System" filed Nov. 23, 1970, for methods for obtaining coolant inlet temperature. An accurate measure of coolant mass flow rate may be obtained from the speed of the coolant pumps. A very accurate and low noise signal may be obtained from the shaft associated with the coolant pumps to determine the pump speed. Each shaft is provided with a large number of teeth or notches around its periphery. Means such as a transducer are provided for detecting the passage of the teeth past a fixed position. The output signal from the transducer consists of an extremely regular pulsed signal with a frequency directly related to the pump speed which is, in turn, directly related to the coolant flow.
In the first equation for DNBR, it is important to recognize that a value of DNBR above 1.3 results in a high probability that acceptable thermal values would exist in the core such that a departure from nucleate boiling would not occur. However, when the DNBR falls below this value, the probability of DNB and clad failure would be expected to increase to unacceptable values. Similarly in equation (2) the KW/ft. limit on the left hand side of the equation is a fixed number determined either by LOCA or the local power density that causes the degree of centerline fuel melting which is adopted as the fuel design limit by the reactor designers. For purposes of generalization and for the purposes of this disclosure, both the DNBR and KW/ft. can be thought of as indices which are indicative of the proximity of operation to the appropriate design limit. The same or similar treatment can be made for any design limit which is amenable to a mathematical representation. Therefore, this invention is applicable to any design limit and any index which can be generated mathematically from parameters of the system.
2. Description of the Prior Art
Heretofore, the prior art has attempted core protection through means and methods that have sacrificed plant capacity and availability. Various schemes with different degrees of sophistication were implemented, none of which enabled the utilization of the plant's full potential. The least sophisticated system consisted of the establishment of a series of independent limits for each of the parameters upon which the design limit in question depended. By so doing, this prior art method could not account for the functional interdependence of all of the variables. Thus, the situation could arise in which one parameter deviated from its optimum value, without causing an approach to the design limit since the other parameters on which the design limit depended might have compensated for the one bad parametric value. Nevertheless, under this prior art system, a reactor trip would have been initiated if the deviation of the one parameter caused the parametric value to exceed the independently determined envelope for that parameter.
A second more sophisticated prior art scheme attempted to utilize, to a greater degree, the functional dependence of the design limit index on the plurality of parameters. However, even in this more sophisticated scheme, certain approximations and assumptions were made to render the functional dependence simple enough so that it could be easily reproduced in analogue circuitry. A typical type of assumption which had to be made was to assume that as many as two or three parameters were either constants held at their design values or were variables which varied only within their allowed envelopes. This second more sophisticated prior art scheme increased the plant availability and capability but, nonetheless, could not approach the optimum operating conditions since the calculations were limited by the degree of refinement which was allowed by the analogue circuitry.
Another common failing of the prior art systems was that there was often no recognition of the fact that it is not sufficient merely to avoid design limit violation on steady state operation, but design limit violation must also be avoided on the occurrence of accidents which cause rapid approach to the design limit. Thus, prior art systems often permitted operation close to the design limit on a steady state basis, without provision for avoiding design limit violation on the occurrence of an anticipated operational occurrence (which is defined as a condition of normal operation which is expected to occur one or more times during the life of a nuclear power plant). The trend toward very large and high power nuclear reactors results in core dynamics not previously considered a problem. Axial and azimuthal xenon oscillations, as well as xenon redistribution after power changes, must be taken into consideration. With reactors operating close to thermal - hydraulic limits, these transient conditions must be coped with relatively quickly. Because of the complexity of determining the core power distribution, an on-line computer is necessary to aid the operator in determining the control actions necessary to maintain the reactor within operational limits. Only by use of plant computers can surveillance and assimilation of the large quantity of plant parameters be handled.
Demands for greater reactor availability and increased emphasis placed on safety requirements designed to protect the reactor's core and the integrity of fuel rod cladding cogently point out the need for a flexible and rapid system which not only prevents the core from exceeding its safety limits but also allows operation of the reactor close to those limits in order to maximize reactor efficiency and availability. Such a protection system must consist of two components: One system for sensing reactor conditions and tripping the reactor when a safety limit violation is imminent, and a second system for calculating the appropriate operating limits which would insure that the protection system has sufficient time to safely trip the reactor while at the same time allowing maximum use of the reactor. In the following discussion, the first system will be called the "core protection calculator" and the second system will be called the "Core Operating Limit Supervisory System" (COLSS). The teaching which is required for an understanding of the mathematical derivations of some of the inputs to these two systems is to be found in the "Appendix to the Description of the Preferred Embodiment".